HackTheBox - Kobold
Source: YouTube · IppSec · published Aug 1, 2026 · 42:16
The Cobalt HTB challenge requires chaining vulnerabilities across three web applications to achieve root, with the primary path involving an RCE in MCP Jam and a Docker container escape, while an unintended vector allows privilege escalation via the newgrp command.
Key Takeaways:
• Initial recon identified subdomains bin.cobalt.htb and mcp.cobalt.htb via SSL certificate analysis 1:59.
• Private Bin had an LFI vulnerability, but encrypted storage prevented direct exploitation for code execution 7:22.
• MCP Jam (v142) contained an unauthenticated RCE, providing a shell as the ben user 10:45 13:30.
• The ben user accessed conf.php in Private Bin's data directory to retrieve the MySQL password for the Arcane application 29:40.
• Logging into Arcane with stolen credentials allowed Docker container management, enabling a root shell via a mounted host filesystem 30:00 31:00.
• An unintended vector allowed ben to join the docker group without a password by leveraging a stale entry in /etc/gshadow and the newgrp command 33:55.
The box highlights the critical importance of proper group management and the severe risks of exposing Docker management interfaces to web applications.
Sources:
- 1:59 Discovery of subdomains via SSL certificate
- 7:22 Analysis of Private Bin LFI vulnerability
- 10:45 MCP Jam unauthenticated RCE vulnerability
- [13:30](https://www.youtub
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is Ippsec, and today I'll be doing Cobalt from Hack The Box. My favorite thing about this box is there's an unintended that lets us essentially join the Docker group without a password. I suspect this is because the creator of the box just removed the user from the group via editing the Etsy group file, which is something I've done many times in the past. However, there is an entry in Etsy Gshadow, and if the user is in the group there, they can then run the new group command to start a new session with that group. Anyways, the box probably is on the tougher end of easy. While each exploit is straightforward to use, when you use the exploit is not straightforward. We essentially have to exploit three different websites, Private Bin, MCPGM, and Arcane, and know…